I think you can use DNS challenge to get a cert without exposed ports, if your DNS has an api that supports it.